I have a user on my domain that keeps on getting her NT account locked out. This happens at anytime even if she is working. I have checked the event viewer on the PDC and found that it is recorded in the Security Log with event ID 539. It says that her account has been locked out. What I have noticed is that the workstation name varies and sometimes its her workstation but most times is from others who have no connection with the user getting locked out. The user then has to conatct us and we have to unlocked her account through User Manager for Domains and she can then continue to work again until her account gets locked out. Does anyone have any suggestions why other workstations would be locking her account out if that is the problem or is there another reason.

Sounds like someone (or something?) is trying to logon to the network from one of the other workstations with her account. When they input the wrong password for the n'th time the account is locked out... no fault of the real user, but it happens anyway. Maybe you have someone trying to hack into your system, either from the outside or the inside? I could understand perhaps a service doing this, but not under Windows 98. You can turn off the account lockout feature or limit the user account to a single workstation. Or you can figure out if someone else is trying to get unauthorized access.

I would disable the account all together and build her a new account with new usernames and passwords. If someone is trying to get in either on purpose or by mistake they will be stopped dead in their tracks.

I dont think that someone is trying to access out network with her user as no-one would know her user ID. The workstations trying to access her account would not even know that she existed. I have checked the event viewer and I have found this Logon Failure: Reason: Account locked out User Name: de405 Domain: NPT Logon Type: 3 Logon Process: KSecDD Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: \\NEILCHAPPLE The workstation name varies and her workstation is called RUTHHENRY. There are many entries in the eventviewer all with different workstation names. Would this happen if she has a folder on her pc that is shared or if she has mapped drives to network resources or to printers?????

Could this also be locking her acoount out if the workstations in the event viewer had a connection to her?????